PT-2023-24735 · Imapsync · Imapsync

Orlitzky · Published 2023-05-30 · Updated 2025-01-10 · CVE-2023-34204

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions imapsync versions through 2.229

Description The issue concerns the use of predictable paths under /tmp and /var/tmp in the default mode of operation. Since these paths are typically world-writable, an attacker can modify imapsync's cache and overwrite files belonging to the user who runs it.

Recommendations For versions through 2.229, consider changing the default temporary directories to a more secure location that is not world-writable, or apply specific permissions to restrict access to these directories until a patch is available.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2023-34204

Affected Products

Imapsync

References · 4

• 🔥 https://github.com/imapsync/imapsync/issues/399 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-34204 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34204 · Vendor Advisory
• https://t.me/cvenotify/107104 · Telegram Post